Red Hat Security Advisory: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode (CVE-2026-56208) * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719) * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718) * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350) * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391) * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356) * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412) * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352) * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368) * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360) * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362) * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358) * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387) * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349) * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357) * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351) * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371) * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379) * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354) * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359) * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383) * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369) * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353) * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396) * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
AI Analysis
Technical Summary
This Red Hat Security Advisory covers a broad set of security fixes for Mozilla Firefox and Thunderbird packages in Red Hat Enterprise Linux 9 and 10. The vulnerabilities addressed include CVE-2026-15718 (invalid pointer in JavaScript WebAssembly component), CVE-2026-15719 (site isolation issue in DOM navigation), CVE-2026-56208 (heap buffer overflow in libaom AV1 encoder), and numerous others involving mitigation bypasses, information disclosure, sandbox escapes due to use-after-free, JIT miscompilation, memory safety bugs, same-origin policy bypasses, and privilege escalations. These issues affect multiple components such as DOM, networking, audio/video, graphics, and enterprise policies. The advisory provides updated packages for Red Hat Enterprise Linux 9 and 10 variants, including Extended Update Support and Extended Life Cycle versions. The vendor rates the overall security impact as Important (high severity).
Potential Impact
The vulnerabilities collectively could allow attackers to bypass security mitigations, cause memory corruption, escape sandbox restrictions, disclose sensitive information, escalate privileges, and compromise site isolation protections in Firefox and Thunderbird. These impacts affect the confidentiality, integrity, and security boundaries of the browser and email client components. However, there are no known exploits in the wild at the time of this advisory.
Mitigation Recommendations
Red Hat has released updated Firefox and Thunderbird packages for Red Hat Enterprise Linux 9 and 10 that address these vulnerabilities. Users should apply these official security updates promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. No additional mitigations beyond applying the vendor-provided patches are indicated. Patch status is confirmed as official-fix.
Red Hat Security Advisory: firefox security update
Description
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * libaom: libaom: heap buffer overflow in AV1 encoder first-pass stats buffer via LAP mode (CVE-2026-56208) * firefox: thunderbird: Site isolation issue in the DOM: Navigation component (CVE-2026-15719) * firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-15718) * firefox: thunderbird: Mitigation bypass in the Enterprise Policies component (CVE-2026-16390) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: cubeb component (CVE-2026-16350) * firefox: thunderbird: Information disclosure in the Storage: IndexedDB component (CVE-2026-16391) * firefox: thunderbird: Site isolation issue in the Networking: HTTP component (CVE-2026-16375) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16356) * firefox: thunderbird: JIT miscompilation in the JavaScript: WebAssembly component (CVE-2026-16363) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153 (CVE-2026-16412) * firefox: thunderbird: Same-origin policy bypass in the Networking: DNS component (CVE-2026-16381) * firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-16355) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13 (CVE-2026-16361) * firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-16352) * firefox: thunderbird: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2026-16368) * firefox: thunderbird: Mitigation bypass in the PDF Viewer component (CVE-2026-16377) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153 (CVE-2026-16360) * firefox: thunderbird: Use-after-free in the WebRTC: Audio/Video component (CVE-2026-16362) * firefox: thunderbird: Site isolation issue in the Graphics: WebRender component (CVE-2026-16358) * firefox: thunderbird: Site isolation issue in the Networking component (CVE-2026-16387) * firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component (CVE-2026-16349) * firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-16357) * firefox: thunderbird: Sandbox escape due to use-after-free in the DOM: Navigation component (CVE-2026-16351) * firefox: thunderbird: Privilege escalation in the DOM: Navigation component (CVE-2026-16371) * firefox: thunderbird: Privilege escalation in the DOM: Content Processes component (CVE-2026-16379) * firefox: thunderbird: Information disclosure in the Graphics: ImageLib component (CVE-2026-16354) * firefox: thunderbird: Information disclosure in the Framework component in DevTools (CVE-2026-16374) * firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-16359) * firefox: thunderbird: Mitigation bypass in the DOM: Networking component (CVE-2026-16383) * firefox: thunderbird: Integer overflow in the JavaScript: WebAssembly component (CVE-2026-16369) * firefox: thunderbird: Invalid pointer in the DOM: Bindings (WebIDL) component (CVE-2026-16353) * firefox: thunderbird: Privilege escalation in WebExtensions (CVE-2026-16396) * firefox: thunderbird: Information disclosure in the Networking: WebSockets component (CVE-2026-16405) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This Red Hat Security Advisory covers a broad set of security fixes for Mozilla Firefox and Thunderbird packages in Red Hat Enterprise Linux 9 and 10. The vulnerabilities addressed include CVE-2026-15718 (invalid pointer in JavaScript WebAssembly component), CVE-2026-15719 (site isolation issue in DOM navigation), CVE-2026-56208 (heap buffer overflow in libaom AV1 encoder), and numerous others involving mitigation bypasses, information disclosure, sandbox escapes due to use-after-free, JIT miscompilation, memory safety bugs, same-origin policy bypasses, and privilege escalations. These issues affect multiple components such as DOM, networking, audio/video, graphics, and enterprise policies. The advisory provides updated packages for Red Hat Enterprise Linux 9 and 10 variants, including Extended Update Support and Extended Life Cycle versions. The vendor rates the overall security impact as Important (high severity).
Potential Impact
The vulnerabilities collectively could allow attackers to bypass security mitigations, cause memory corruption, escape sandbox restrictions, disclose sensitive information, escalate privileges, and compromise site isolation protections in Firefox and Thunderbird. These impacts affect the confidentiality, integrity, and security boundaries of the browser and email client components. However, there are no known exploits in the wild at the time of this advisory.
Mitigation Recommendations
Red Hat has released updated Firefox and Thunderbird packages for Red Hat Enterprise Linux 9 and 10 that address these vulnerabilities. Users should apply these official security updates promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. No additional mitigations beyond applying the vendor-provided patches are indicated. Patch status is confirmed as official-fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:47101
- Cve Count
- 32
- Additional Cves
- ["CVE-2026-15719","CVE-2026-16349","CVE-2026-16350","CVE-2026-16351","CVE-2026-16352","CVE-2026-16353","CVE-2026-16354","CVE-2026-16355","CVE-2026-16356","CVE-2026-16357","CVE-2026-16358","CVE-2026-16359","CVE-2026-16360","CVE-2026-16361","CVE-2026-16362","CVE-2026-16363","CVE-2026-16368","CVE-2026-16369","CVE-2026-16371","CVE-2026-16374","CVE-2026-16375","CVE-2026-16377","CVE-2026-16379","CVE-2026-16381","CVE-2026-16383","CVE-2026-16387","CVE-2026-16390","CVE-2026-16391","CVE-2026-16396","CVE-2026-16405","CVE-2026-16412"]
- State
- PUBLISHED
Threat ID: 6a6940099c2644c7f8665d73
Added to database: 07/28/2026, 23:49:29 UTC
Last enriched: 08/06/2026, 22:49:43 UTC
Last updated: 09/12/2026, 10:01:29 UTC
Views: 59
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.